Malicious Code Vulnerability in parwo-poke80: Exploiting npm for Token Rewards
Summary
MAL-2025-164056: Malicious code in parwo-poke80 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
parwo-poke80 is an npm package that has been implicated in a malicious campaign aimed at exploiting the npm registry. This package is part of a broader initiative that aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. The malicious nature of this package lies in its ability to modify its own metadata and continuously republish itself under various names, thereby polluting the npm ecosystem.
Vulnerability Detail
The vulnerability in parwo-poke80 originates from its design to include autopublish scripts that remove private flags from package.json, change version numbers, and generate random package names. This behavior not only compromises the integrity of the npm registry but also poses a risk to developers who may unknowingly install these malicious packages. The continuous republishing of these variants can lead to a significant increase in the number of malicious packages available, making it difficult for users to identify legitimate software.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall parwo-poke80If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the parwo-poke80 package altogether. If it is already part of your project, consider removing it and replacing it with a trusted alternative. You can also use the following command to uninstall it: npm uninstall parwo-poke80.
Conclusion
The parwo-poke80 package has been identified as a malicious entity within the npm ecosystem, designed to exploit the registry for token rewards. It is crucial for developers to remain vigilant and remove any instances of this package from their projects. Utilizing tools like Vulert can aid in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for parwo-poke80 →
FAQ
The vulnerability involves malicious code that modifies package metadata and republishes itself under various names, which can lead to the pollution of the npm registry.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check your application without any signup.
If you have installed parwo-poke80, it is advisable to uninstall it immediately and check for any potential impacts on your application.
Currently, there is no specific patch for parwo-poke80, but you should monitor the npm registry for updates and advisories regarding this package.
Using compromised npm packages can lead to security vulnerabilities, data breaches, and the potential for malicious code to be executed within your application.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
